Sometimes the vulnerable code is not in the library you chose but in something it pulls in. Secure Libraries is Safeguard's answer for that case.
What it is
The page describes a curated catalogue of open source libraries across npm, PyPI, Maven, Go, Cargo and RubyGems, rebuilt by Safeguard and served through a registry mirror that works with existing package managers. Names and APIs match upstream. Where upstream has an unfixed CVE in a transitive dependency, Safeguard re-pins it to a patched version and republishes.
Packages carry a Sigstore signature and an in-toto attestation covering the source commit, build platform and patch set. A lockfile generator pins to vetted variants where they exist and to upstream otherwise. Unsigned packages fail closed at install, and the verification key is pinned. It can chain beneath private registries and supports air gap installs from a verified bundle.
How to use it
- Point one project at the mirror.
- Generate a lockfile with the CLI.
- Run your tests and compare the dependency list with the old one.
- Subscribe to patch notifications, which include a CVE delta and an upgrade command.
What to verify
The page claims most patch timings are under 48 hours and that a public registry compromise would not matter. Both depend on the pinned key and verification working as described, and the page gives no threat model or figures. Test an unsigned package and confirm it fails.
Quick check
What happens to an unsigned package at install?
According to the page, it fails closed.
